What is the CVSS score of CVE-2026-53376?

CVE-2026-53376 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-53376?

Yes, a patch is available for CVE-2026-53376. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-53376

Q: Which versions of Linux Kernel are affected by CVE-2026-53376?

Missing upper bound validation on `num_of_nodes` in the AMD KFD ioctl handler `kfd_ioctl_get_process_apertures_new` allows a local low-privileged user with access to AMD GPU compute devices to crash…. A patch is available.

EUVD-2026-45449 MEDIUM

2026-07-19 Linux

GHSA-gg3c-2842-qwrx

Information Disclosure Linux

5.5

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain local low-privilege shell
Delivery

Access /dev/kfd device node
Exploit

Issue crafted ioctl with oversized num_of_nodes
Execution

Trigger out-of-bounds kernel memory access
Impact

Kernel panic crashes entire system

Vulnerability Assessment

Exploitation Conditions	Exploitation requires three concurrent conditions: (1) the target system must have AMD GPU hardware present with the amdkfd kernel module loaded; (2) the attacking user must hold a valid local login or equivalent code execution context on the system; (3) the user must have permission to open /dev/kfd - on many distributions this is granted to members of the 'render' or 'video' group, not only root. The CVSS PR:L metric confirms that low-privilege (non-root) authenticated access is sufficient. Remote exploitation is not possible. Systems without AMD GPU hardware, those where amdkfd is not loaded, or where /dev/kfd is restricted to root-only access are fully protected from exploitation regardless of kernel version.
Impact	The NVD CVSS 5.5 (Medium) score accurately reflects the constrained attack surface: AV:L requires local system access, PR:L requires at minimum a non-root user account with permission to open /dev/kfd, and A:H reflects a kernel panic causing total system availability loss. The EPSS score of 0.16% at the 5th percentile strongly suggests negligible threat actor interest and no observed automated exploitation. No CISA KEV listing and no public exploit code has been identified. One data conflict warrants attention: the tag 'Information Disclosure' is inconsistent with the CVSS C:N metric - the CVSS vector is likely the authoritative signal here, indicating the primary impact is availability (crash), not data leakage; however, an out-of-bounds read prior to crash could theoretically expose kernel memory contents to the calling process. This potential secondary impact is unconfirmed from vendor data. Real-world risk is low to negligible for most deployments; it is meaningful only on Linux systems running AMD GPU compute workloads (HPC clusters, ML infrastructure, workstations with AMD discrete GPUs).
Exploit ScenarioDerived	A local user on a Linux system equipped with an AMD GPU opens the /dev/kfd device node and issues a crafted `kfd_ioctl_get_process_apertures_new` ioctl call with a maliciously oversized `num_of_nodes` value. The kernel accesses memory beyond the bounds of the expected node array without validation, triggering a kernel oops or panic that crashes the entire system. No public exploit code has been identified at time of analysis.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 29, 2026

Missing upper bound validation on num_of_nodes in the AMD KFD ioctl handler kfd_ioctl_get_process_apertures_new allows a local low-privileged user with access to AMD GPU compute devices to crash the kernel, causing a denial of service. Affected are Linux kernel branches prior to 6.6.140, 6.12.90, 6.18.32, 7.0.9, and 7.1, restricted to systems with AMD GPU hardware and the amdkfd module loaded. EPSS is 0.16% (5th percentile), no public exploit or CISA KEV listing exists, and patched stable releases are available across all active stable branches.

RemediationAI

Update the Linux kernel to a patched stable release: 6.6.140, 6.12.90, 6.18.32, 7.0.9, or mainline 7.1. Upstream stable fixes are available at git.kernel.org (commits 4a8093c7def1, 6ba6ec5fcbb0, 44d5a450c04d, 7b80137eb8aa, 74b73fa56a39). Ubuntu users should apply the kernel packages referenced in USN-8574-1 at https://ubuntu.com/security/notices/USN-8574-1. Where immediate patching is not feasible, restrict access permissions on /dev/kfd to only trusted users or groups via udev rules (e.g., MODE='0600', GROUP='render') - trade-off: this breaks ROCm/OpenCL access for non-privileged compute users. Alternatively, blacklist or unload the amdkfd module (rmmod amdkfd or add blacklist amdkfd to /etc/modprobe.d/) if AMD GPU compute is not required - trade-off: disables all AMD GPU compute workloads (ROCm, OpenCL, HIP) on the system.

Affected VersionsENISA

Linux patch: 6.18.32

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <7b80137eb8aa9d1cbfe7ccf3eeb1faa94ae35d7e

Linux 0 <6.12.90

Linux 0 <6.6.140

Linux patch: 6.12.90

Linux patch: 6.6.140

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <4a8093c7def141cc6e854fbe3f9693867982418f

Linux patch: 7.1

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6ba6ec5fcbb0d03ca11ed1cc38d57a7deb6c6b20

Linux 0 <7.0.9

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <74b73fa56a395d46745e4f245225963e9f8be7f1

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <44d5a450c04d3d734c13a03561c3131020d66edf

Linux 0 <6.18.32

Linux patch: 7.0.9

Affected Packages

euvd linux fix: 6.6.140, 6.12.90, 6.18.32, 7.0.9

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The AMD Kernel Fusion Driver (amdkfd) is the Linux kernel compute driver enabling GPU compute workloads such as ROCm and OpenCL on AMD GPU hardware. The vulnerable function kfd_ioctl_get_process_apertures_new handles a userspace ioctl request to enumerate process memory apertures (GPU virtual address regions) across GPU nodes. Without an upper bound check on the caller-supplied num_of_nodes parameter, the kernel may perform out-of-bounds memory access - indexing or allocating beyond a fixed-size structure - when the value exceeds the maximum supported count. The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* confirms the Linux kernel itself as the affected component. No CWE was formally assigned, but the root cause class is consistent with CWE-20 (Improper Input Validation) or CWE-129 (Improper Validation of Array Index), where unchecked userspace input directly controls kernel memory operations. Five separate stable-branch backport commits were applied at git.kernel.org (4a8093c7, 6ba6ec5f, 44d5a450, 7b80137e, 74b73fa5), indicating broad version impact across maintained stable trees.

Know when the next one hits your stack

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI 5.5 MEDIUM

Local /dev/kfd device access (AV:L) and low-privilege ioctl call (PR:L) required; kernel panic yields total availability loss (A:H) with no confirmed confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SUSE 6.6 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Jul 29, 2026 - 17:07 NVD

5.5 (MEDIUM)

Patch available

Jul 19, 2026 - 13:02 EUVD

CVE Published

Jul 19, 2026 - 10:01 nvd

MEDIUM 5.5

CVE Published

Jul 19, 2026 - 10:01 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Add upper bound check for num_of_nodes

drm/amdkfd: Add upper bound check for num_of_nodes in kfd_ioctl_get_process_apertures_new.

(cherry picked from commit 98ff46a5ea090c14d2cdb4f5b993b05d74f3949f)

Threat Intelligence Overview

EPSS Score

0.2%

Top 95% exploitable

Prevalence

Medium

AMD GPU compute driver, requires specific AMD GPU hardware presence

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.2%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Small

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +28

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53376 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8574-1 ADVISORY https://vuldb.com/vuln/380105 REF https://git.kernel.org/stable/c/44d5a450c04d3d734c13a03561c3131020d66edf REF https://git.kernel.org/stable/c/4a8093c7def141cc6e854fbe3f9693867982418f REF https://git.kernel.org/stable/c/6ba6ec5fcbb0d03ca11ed1cc38d57a7deb6c6b20 REF https://git.kernel.org/stable/c/74b73fa56a395d46745e4f245225963e9f8be7f1 REF https://git.kernel.org/stable/c/7b80137eb8aa9d1cbfe7ccf3eeb1faa94ae35d7e REF https://git.kernel.org/stable/c/f0f19e614cdd7d9cff2fb280cf923c99256d7915

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back